5569 matches found
CVE-2025-48340
CVE-2025-48340 refers to a CSRF to Privilege Escalation vulnerability in WordPress plugin User Profile Meta Manager (Danny Vink), affecting versions 1.02 and earlier. The issue enables privilege escalation through CSRF; no exploitation details are provided in the sources. Remediation guidance fro...
CVE-2025-48340 WordPress User Profile Meta Manager plugin <= 1.02 - CSRF to Privilege Escalation vulnerability
Cross-Site Request Forgery CSRF vulnerability in Danny Vink User Profile Meta Manager allows Privilege Escalation.This issue affects User Profile Meta Manager: from n/a through 1.02...
CVE-2025-2892
The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post Meta Description and Canonical URL parameters in all versions up to, and including, 4.8.1.1 due to insufficient input sanitization and...
CVE-2025-2892: Improper Neutralization of Input During Web Page Generation
The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post Meta Description and Canonical URL parameters in all versions up to, and including, 4.8.1.1 due to insufficient input sanitization and...
CVE-2025-48340: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Danny Vink User Profile Meta Manager user-profile-meta allows Privilege Escalation.This issue affects User Profile Meta Manager: from n/a through = 1.02...
CVE-2025-47284: Improper Neutralization of Escape, Meta, or Control Sequences
Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in the gardenlet component of Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0. It could allow a user with administrative privileges for a...
WordPress plugin User Profile Meta Manager 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
Meta sent cease and desist letter over AI training
EU privacy advocacy group NOYB has clapped back at Meta over its plans to start training its AI model on European users' data. In a cease and desist letter to the social networking giant's Irish operation signed by founder Max Schrems, the non-profit demanded that it justify its actions or risk...
MAL-2025-3905 Malicious code in meta-ai-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 230f2c424df3ca5115f3d575ba5a15c46f2a591f9a8ed4ec503c6bb5490ea355 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in meta-ai-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 230f2c424df3ca5115f3d575ba5a15c46f2a591f9a8ed4ec503c6bb5490ea355 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Noyb Threatens Meta with Lawsuit for Violating GDPR to Train AI on E.U. User Data From May 27
Austrian privacy non-profit noyb none of your business has sent Meta's Irish headquarters a cease-and-desist letter, threatening the company with a class action lawsuit if it proceeds with its plans to train users' data for training its artificial intelligence AI models without an explicit opt-in...
CTM360 Identifies Surge in Phishing Attacks Targeting Meta Business Users
A new global phishing threat called "Meta Mirage" has been uncovered, targeting businesses using Meta's Business Suite. This campaign specifically aims at hijacking high-value accounts, including those managing advertising and official brand pages. Cybersecurity researchers at CTM360 revealed tha...
kernel: erofs: fix missing unmap if z_erofs_get_extent_compressedlen() fails
A resource leak flaw was found in the Linux kernel's EROFS filesystem. When zerofsgetextentcompressedlen fails, the corresponding meta buffer is not properly unmapped, leading to a memory leak over time...
CVE-2025-43002
CVE-2025-43002 affects SAP S4CORE via the OData meta-data property. The root cause is a missing authorization check, allowing an authenticated attacker to access restricted information. Impact is described as low confidentiality impact with no reported effects on integrity or availability; CVSS 3...
CVE-2025-43002: External Control of Assumed-Immutable Web Parameter
SAP S4CORE OData meta-data property allows an authenticated attacker to access restricted information due to missing authorization check. This could cause a low impact on confidentiality but integrity and availability of the application are not impacted...
CVE-2025-4335
The Woocommerce Multiple Addresses plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.7.1. This is due to insufficient restrictions on user meta that can be updated through the savemultipleshippingaddresses function. This makes it possible for...
WhatsApp hack: Meta wins payout over NSO Group spyware
Meta has won almost $170m in damages from Israel-based NSO Group, maker of the Pegasus spyware. The ruling comes after a six-year legal case against the company after Meta accused it of misusing its servers to spy on users. According to the original complaint against NSO Group, filed in October...
Israeli NSO Group Fined $168M for Pegasus Spyware Attack on WhatsApp
US jury orders NSO Group to pay $168M to WhatsApp and Meta over Pegasus spyware use in 2019…...
CVE-2025-4335
The Woocommerce Multiple Addresses plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.7.1. This is due to insufficient restrictions on user meta that can be updated through the savemultipleshippingaddresses function. This makes it possible for...
CVE-2025-4335 Woocommerce Multiple Addresses <= 1.0.7.1 - Authenticated (Subscriber+) Privilege Escalation
The Woocommerce Multiple Addresses plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.7.1. This is due to insufficient restrictions on user meta that can be updated through the savemultipleshippingaddresses function. This makes it possible for...